Today, Talos is publishing a glimpse into the most prevalent threats we've observed over the past week. Unlike our other posts, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of date of publication. Detection and coverage for the following threats is subject to updates pending additional threat or vulnerability analysis. For the most current information, please refer to your FireSIGHT Management Center, Snort.org, or ClamAV.net.

Win.Ransomware.Cerber-5901829-0 Ransomware

Cerber is a ransomware variant which encrypts a user's personal data such as office documents, pictures, and music. Cerber also attempts to exfiltrate browser history. If Cerber is unable to reach C2 server specific domain names, it will ping specific IP Address ranges over TCP on port 6892.

Indicators of Compromise
Registry keys created

Key Value name Value data
HKEY_USERS\Software\Microsoft\ Windows\ShellNoRoam\MUICache C:\WINDOWS\system32\ mshta.exe Microsoft (R) HTML Application host
HKEY_LOCAL_MACHINE\SYSTEM\Cont rolSet001\Control\Session Manager PendingFileRenameOper ations \??\C:\001984854a008441d5a8804 10dd582a0ee6f68bbc0068abeab1f4 df1ae0b8af9.exe


Registry keys modified

  • N/A Mutex Created
  • shell.{3EB72F14-EB8C-7844-D6B0-CDB105275440}
    Files Created

Cerber drops a file named README.hta in all places it's encrypting files and on disk in the following locations:

  • %HOMEDRIVE%\README.hta
  • %APPDATA%\Microsoft\Windows\Cookies\Low\README.hta
  • %ALLUSERSPROFILE%\Sample Pictures\README.hta
  • %ALLUSERSPROFILE%\Cookies\README.hta
  • %HOMEPATH%\Contacts\README.hta
  • %HOMEPATH%\Desktop\README.hta
  • %TEMP%\README.hta Note that this is a non-exhaustive list.

    IP Addresses
  • 104.16.149.172
  • 194.165.16.0/24
  • 194.165.17.0/24
  • 194.165.18.0/24
  • 194.165.19.0/24  Domain Names

A DGA algorithm is used to generate the host and the domains name in use. Currently hosts contacted look like:

  • vyohacxzoue32vvk.[a-z0-9]{6}.(bid | top)
  • btc.blockr.io More generic domains can be identified with with regex: [a-z0-9]{16}.[a-z0-9]{6}.(top|bid)

Example:

  • hjhqmbxyinislkkt.1mvku2[.]top File Hashes
  • 001984854a008441d5a880410dd582a0ee6f68bbc0068abeab1f4df1ae0b8af9
  • f1246caf5b90ffaa5dc03d7c74be88c866627730e79c8da722799b11c576afaa
  • bdb7527abf68bd948502dcbd8663382b822910344c21fce1ac9bc0036cb26274
  • b48cec5ed5334f1526308bd9e40cde4877265fad488fd6d7935bd6b19edb196a
  • 349ed9b9bd21ef37e31b062793b5648f87607b8815a32d425dca5a322d4e5b9e
  • cd96f99b90ed85833ac19508d9c445a7352c971819e68073789aaf827fc21c2a
  • c441013fcffe2b8bc71c4254882341883eab29db3eab05148c25b747113447ab
  • 553d1a73ad634922ad77a317ca3ccd6a0b27a5d67b3429d0f08ea7c7b9967401
  • 11a375d808fe0d440bbb6808766fc648a210b5621ae80908673b4f358ebae8ff
  • 623c520afc9b32b4777accd9cb9b4422f49a53fc9fe6ff7dc21b7ffd783563ed
  • bc753af8a4b203091fb6924e8f88a180e259ac77500eb056b7d04d840ee884e4
  • ffde0727f1b487d1a7b84912a2d923e5a7e5443673bee34e89acfd70ef7b1918
  • 182dee2062bbbefad0090da61a8b4bdf9d95fa7db621fac9725ad165505b4f1b
  • d5ffa9e5b51342eb7c6df5fe7cd60d95ad74955617524148b6e20bc054f0d151
  • 938986cb2e87323e482e9d772200157abcacbbe9f962f197276555f750b24c25
  • e5ecdb92220696f09ad3500d8e52da3ecfb4f6e00cce6d0a9f224b30e7071394
  • b48e859aa8e297cf0bf6bb312c8845f18c4b822e84f6196ffde4d6a08530efd7
  • d2c8cc05a9ff073b7cf20026dee5f75a40125babb3c511e22627c9b2e4cf4c44
  • 435b6935c28a3aad18a0d065c5ed851b797ae6963ae151b96628fff6d1bd8b59
  • 63e1232a12bf86e1bdf9c1527b64eb3e6ae7cd1edb29ce9e2d518912e42d53aa
  • 515e6c0cc23d0f8ff7a57737fbc1a7f06cdc86a46985086f91e39afa6d884da7
  • c8e32211dc0e0f5477d5424831f1261786adbca862c63f581d88d4448ecdbf1a
  • 1180dac56afb5cdb93f910f4f1e9abcb2584462186ec26b7cc7fae8ae4d99db4
  • 082496e6e7f49099ac4fe0f6d0652c3a8a2b87f54b05fcf1efef9e006cfa57a7
  • 8fd920aa1a4d2b7e7082758c3fe6212fa664258862bfd05ca977a7e01456a2bf
  • facb0523eb66f1b2262a81a5fb898c4ab3012c3ade377833906a43d5942ceff0

Coverage

Detection Engines ThreatGrid


Umbrella


Malware Screenshots



Doc.Macro.Generic-5900096-0

Macro downloader
Macro enabled office documents can be used to download malicious software or perform malicious operations on a system. This treat focuses on a common method used in macro code to download malicious software from an external source.

Indicators of Compromise
Registry keys created

  • N/A Registry keys modified
  • N/A Mutex Created
  • N/A Files Created
  • C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\<download_file>.exeIP Addresses
  • 89.248.103.159 Domain Names
  • www.e-funciona.com File Hashes
  • 3641801c289e5f76ba3a10858567b15a46640ba26ea7d8402eff2016ad4067fc
  • 607aaabcff0390969193e26f2e5c6ecebc879686028ca39e29c1a4cf10267378
  • 433f3d7209ca4be18b5afdef5651c46ec8f5f955a962f3faf7cc472108ff01d4
  • 0e3cc78a6cc51199816d459ba6281e330fee7f4b6e0dd6f9d9c818874651cafa
  • a8996fcc148fd2fd82c1551d3d874d7b4550fcab4ad4bdbdf7c5a7f0db7ec70a
  • 21cb74721704ed761414a3929dec6d4723416594957a3c3b6075855e4f740729
  • 1284cf7a0710e38584d430df6cdabda80c321a124b278e010ca0f2f70ba2e53b
  • 1352bacc05c1f5414a1f1393c87044f533d2e3c293d42fae1753e3f55f6898ce
  • 8f208af31938adbbcf311317e43e14f8ab181b3038e399e2ba1dff2004c5378e
  • f41e5af285ec67f0d08910a91434a5cac4edbcf0bb2713e7773ebe582ccd5d46
  • aed55db2b5be215986d182743f07a64d450b26dc4f29007e9ae2192edaf3b924
  • 9df62b06bb1c7ff1fcd863d072375c46f6c4132be9dbd89619be1e59993e4d94
  • fcc21c98615be7118730e801e15122fad58a8fa75e7d27aff2917694fb465c61
  • e89f1ae146aa47bbf5aff559d19b3a91453ef174759a3c4bb2a67c809f6e22c0
  • ddaeae452c0c61842316f574ef77fcd3fcba80df4afc4e22a444ec500663bef9
  • dd7a69629cc7c0c975bdc18eee9e7b6c38e846854e6ac01900aa0d1ae332fe62
  • d8f52f4f6c8b344dcc421577c77746f7175fb74fa1222578092e10b5c0be07be
  • ba20e30a94e8a815bddfc099df321cdad7d72927f944cb20ec200bf0291d3398
  • b195291047d3c48738c48bbb604f4c5e85aec9dd03ccae29924acc7cff9a03a6
  • 8a6f159fa8d744a384ab0dd5047de64e3bf6e99065afd35e96f42fb832230f9b
  • 814b26f19c396af49ba0d39d434ab30c994984426996dc11c6f7418d80648609
  • 70a18da4a41d5aa74b943f8c9a0572e8324d66826f64de7ea548e58a89cacaa5
  • 4e21a3b4ebc76407f70f2b9d9e3a30eec54e4fbeaa64020ac0648873c52b5905
  • 4b895aaf6631ae677efc53ba9e416a444bc78df3cd2e3da400aa2968a9ae8db2
  • 4b759728a284da96aefe30ea5f4b668d96dccd8c2f9630bf6786eb26b5650a06

Coverage

Detection Engines
ThreatGrid


Umbrella



Win.Trojan.Infostealer-5900674-0 Trojan (credential stealer)

Infostealer is a Windows trojan & acts as a stealer for credentials submitted through the Mozilla Firefox & Google Chrome web browsers. It uses a SQLite database to store the harvested credentials. Observed samples were written in the Delphi & packed with UPX. With no discernable network traffic during runtime, we suspect that the stolen credentials are held locally for another component in attacks that drop this trojan.

Indicators of Compromise  Registry keys created

  • N/A Registry keys modified
  • N/A Mutex Created
  • \BaseNamedObjects\CTF.LBES.MutexDefaultS-1-5-21-2741372430-2673733078-4290318639-500
  • \BaseNamedObjects\CTF.Compart.MutexDefaultS-1-5-21-2741372430-2673733078-4290318639-500
  • \BaseNamedObjects\CTF.Asm.MutexDefaultS-1-5-21-2741372430-2673733078-4290318639-500
  • \BaseNamedObjects\CTF.Layouts.MutexDefaultS-1-5-21-2741372430-2673733078-4290318639-500
  • \BaseNamedObjects\CTF.TMD.MutexDefaultS-1-5-21-2741372430-2673733078-4290318639-500
  • \BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-2741372430-2673733078-4290318639-500MUTEX.DefaultS-1-5-21-2741372430-2673733078-4290318639-500 Files Created
  • %TEMP%\sqlite3.dll
  • %SystemDrive%\history.txt
  • %APPDATA%\moz.tmp
  • %TEMP%\0.tmp
  • %TEMP%\31379.tmp
  • %SystemDrive%\pass.txt IP Addresses
  • N/A Domain Names
  • N/A File Hashes
  • 68f794cefe42c5b746abea703856036fed7ceaf571220874d8b70782d8d81569
  • 2940298afc9b926b95a501ae12b28024b2e070eabffe28ca3da0f08f33c2c6c8
  • 62aa96177f224e58362278d3424f90ebd4512b61214a36024685b0c7704ec60a
  • 6850b01820037dbf2264f43140ff7780c35abef14d8c6e6bd8da9248a1b88943
  • 864f375840c009d6260e2ac143dd09404e262b012e1ee4a16902f99004cbc862
  • 68f794cefe42c5b746abea703856036fed7ceaf571220874d8b70782d8d81569
  • a38ac23db7f5c3343285e3a17d48823756c56e9a946e56fdd9612265c40f9f99
  • c8badfa7fe40d9bc10a33c118a75b920b4eb8f2f3d831376c095ba02515c7176
  • e8e697802bf0219cb54ab97910d436ef2e7dbe1c2a4abf0b406a42e2507265c1

Coverage

Detection Engines ThreatGrid



Doc.Macro.Laroux-5893719-0 Macro downloader

Macro enabled office documents can be used to download malicious software or perform malicious operations on a system. This threat focuses on a common method used in this malware family to start code execution.

Indicators of Compromise Registry keys created

  • N/A Registry keys modified
  • N/A Mutex Created
  • N/A Files Created
  • N/A IP Addresses
  • N/A Domain Names
  • N/A File Hashes
  • 0e6dcb17c222cf90bec20d6e2f4e7e8ce3c0a6ea3a9960e5914be4eb8dce6cab
  • 155a0409cecddf0ac869ca2c15a2b55c746c6f940ee3d8a9f08a91554add7b2d
  • d3678428b6939ed19211b5b88a079f33e556d4e547c5acb1eaa148366d0b6e6d
  • 13853b3d52b4e19a7a4b1dfb620f6ee28fc02ff3fb6162ebfca3ee6219a30bbc
  • 78fcadb4d82afe19799c4a47626a8faf75fc56ecde28bd250f33f90e79c65e42
  • 949dcec4d0a79d1296366353794a275b0bea056bb099558f8c231afe8cb9adff
  • be1e11932dd5820dc45e3fdcde360af6634dfc0da5cbf9de9b7a717de50b0ec9
  • 529239d98ee139cc276daff5db157746a2a421cbe0f7bd870a8f10d51452bb20
  • afd854fa48077adb87b3e700f6695c9d5ef74e77353328337ef7c591060f5f89
  • d5111633f192a9a83cc39b4d8c9717a0d284a00acc1af4274f85319ac0034505
  • 0d1a187f252848e219053845351c3b07d440587d55cc624b0b2d59419ea8a896
  • 180caf6d44cdec9c977aac2f2bd2d15ba10477bcba7bccbaba720503dd5eb021
  • 4701392544a60dc493e13179ab0b3a709217961353e6e404a40d2278b4dbd6d2
  • 4c499c70249e9e953c0b63f13c3d2c368e07b04e0a44cb1b3fd05e4aa4f13f56
  • 6921de7df37141ca093a24d1184e4812ce5883cc86383f6435d85ff561c58bc6
  • b2de2b00c0494238c04784e7a03307d1680eee4f2e6a8b40df455bf91db8898a
  • b332cde3d53ff68390f666f86f270ca005926ae66d47322fac839291518db1ef
  • 1bc489abc45a3db159c2d43cb220f3f3e7aaa6d40eba49758150e40c3df03ff2
  • 40e498704f3f4f807e807f59c0644e457e1690847d43dcbd43aa1b4d41b41e4a
  • 5e930fe0323d09a4e7c10edbc8bf8d51e2826be344a3778695c7adb8eda10ca4
  • 66d223fd0f0b2ce642755bb18f876e919c91dfedcdb84ffb79eba2de8b0e10eb
  • 6abffacb8a95bf7d67fe7544f2020e90109be89a0a5ec754def98377b361e81f
  • 6b03f59727e07f63340c1a1603538c107d2008c08fb34f3f47d6ecb352b391f0
  • 7a2e044f1716d2236800dd4dd186cd5224abe779692cd5e0767714798aaa430a
  • 7a750bd06456920deeb26929b5bfd8c9a7a0106c917e0aacd79b7b39ba505675

Coverage

Detection Engines
ThreatGrid